Privacy Policy

Effective October 31, 2026 · supersedes the version effective October 25, 2026

Scope of this Policy

This Privacy Policy describes how MCM Labs (“MCM Labs,” “we,” “us” or “our”), a contract manufacturer located at 5260 S Decatur Blvd, Suite 5, Las Vegas, NV 89118, collects, uses, discloses and otherwise processes personal information in connection with the website located at mcm-labs.com (the “Site”), our business correspondence and our business-development activities. By accessing the Site or engaging with our correspondence, you acknowledge the practices described in this Policy. Questions concerning this Policy may be directed to info@mcm-labs.com or (702) 728-0966.

Categories of information we collect

Information you provide. When you submit a product brief, correspond with us by email or telephone, or otherwise communicate with us, we collect the information you elect to provide, including identifiers (name, email address and, at your option, company name, telephone number and social media handle) and commercial information concerning your project (product format, anticipated volume, sales channel, target audience, objectives, stage of development, how you heard about us and the content of your message).

Server and technical information. Our hosting provider automatically records standard request information when the Site is accessed, including Internet Protocol (“IP”) address, browser type, the page requested and the time of the request. This information is used to operate and secure the Site.

Site analytics. Where analytics are enabled for you (see “Your choices” below), we use PostHog to analyze use of the Site. Until then, PostHog is not loaded and none of the following is collected. It records:

• Site activity: pages viewed and exited, buttons and links selected (including our email and telephone links), scroll depth, the goal selected in the product explorer, the path selected on the brief form, whether a product brief was started and submitted, and your answer to “How did you hear about us?” if you give one
• Visit information: the page address (including any campaign parameters in the link), the referring page or site, and the time
• Device information: browser and operating system and their versions, device type, screen and window dimensions, language setting and time zone
• Approximate location: a general location, at the level of city and country, derived from the IP address

Our analytics operate in a cookieless configuration and do not record your screen, mouse movements or keystrokes. The name, email address, telephone number and brief text entered into our forms are not transmitted to our analytics provider. To count visits without cookies, PostHog derives a pseudonymous identifier on its servers from your IP address and browser characteristics.

Correspondence attribution. Hyperlinks to the Site contained in business correspondence we send may include a unique, randomly generated reference code. When you access the Site through such a link and analytics are enabled for you, the reference code is retained in your browser’s local storage for up to ninety (90) days and is associated with the pages you view and the actions you take on the Site during that period. This enables us to associate Site activity with the correspondence to which it relates, and therefore with the recipient of that correspondence. The reference code does not itself contain your name, email address or other directly identifying information.

Interest-based homepage. Where analytics are enabled for you, when you view certain pages of the Site, select certain links or choose a path on our brief form, the Site records in your browser’s local storage a general interest category (gummies; tablets and capsules; launching a new brand; or an established brand), together with an expiry date. On later visits, our homepage displays introductory content matched to that category. The category is retained for up to ninety (90) days, does not itself contain your name, email address or other directly identifying information, and is included with the Site activity described above so that we can compare how each version of the homepage performs. Where you access the Site through a link containing a correspondence reference code, the category forms part of the Site activity associated with that correspondence, as described under “Correspondence attribution.”

Organization-level identification. Where analytics are enabled for you, we may engage a third-party business-intelligence provider that associates the IP address of a Site visit with the organization that operates the originating network, together with publicly available firmographic information about that organization (such as its name, industry, size and website). Such providers may use cookies or similar technologies, subject to their own privacy notices. We use this information to understand which organizations have an interest in our services.

Purposes of processing

We process personal information for the following business purposes:

• To respond to inquiries and to evaluate, quote and perform projects, and to administer the relationship if you become a client
• To conduct business development, including determining the relevance and timing of follow-up correspondence and tailoring its content to the interests demonstrated by a recipient’s interaction with the Site
• To operate, maintain, secure and improve the Site
• To analyze use of the Site in aggregate
• To comply with legal obligations and to establish, exercise or defend legal claims

We use the details of your project only to evaluate and perform that project with you, and we treat product briefs as confidential. If you require an executed confidentiality agreement before disclosing a formula or other sensitive information, please request one before sharing it.

Disclosure of information

We do not sell personal information for monetary consideration, and we do not share personal information for cross-context behavioral advertising. We disclose personal information only to:

• Service providers and processors acting on our behalf and subject to contractual restrictions, including our website host (Vercel), our analytics provider (PostHog), the form services that deliver product briefs to our inbox (Google, through a script in our own Google Workspace account, with FormSubmit as a backup), our email provider and any organization-identification provider we engage
• Governmental authorities or other parties where required by law or to protect our rights, property or safety
• A successor entity in connection with a merger, acquisition, financing or sale of assets

Cookies, local storage and preference signals

Except as described under “Correspondence attribution,” “Interest-based homepage” and “Organization-level identification,” the Site does not place advertising cookies or cross-site tracking technologies, and our first-party analytics operate without cookies.

Your choices. When you visit, our hosting provider estimates your state or country from your IP address so that the Site can apply the appropriate default; we do not store that estimate. If you appear to be in California, or your location cannot be determined, the Site asks whether you accept analytics, and until you select “Accept” it does not load PostHog, does not retain a correspondence reference code or an interest category, and does not load organization-identification technology. Elsewhere, analytics are enabled by default, and the Site remembers that default in your browser’s local storage for up to thirty (30) days. Wherever you are, you may select “Reject” at any time through the “Privacy choices” link at the foot of every page; none of the above then runs, any code or category previously retained is removed, and the Site records your choice in your browser’s local storage for up to one (1) year so that it does not ask again.

We honor the Global Privacy Control (“GPC”) signal: where your browser transmits a GPC signal, the Site treats it as “Reject,” regardless of your location or any earlier choice: it will not load our analytics, will not retain a correspondence reference code or an interest category, will remove any code or category previously retained, and will not load organization-identification technology. Because industry standards for “Do Not Track” signals remain unsettled, we treat the GPC signal as the operative preference signal.

Links to other sites, including our customer portal, staff sign-in and MCM Gummies, lead to pages governed by their own policies.

Retention

We retain inquiry and project records for as long as reasonably necessary to fulfil the purposes described above and to maintain ordinary business records. Correspondence reference codes and interest categories expire from your browser after ninety (90) days. Analytics and attribution records are retained only for so long as they remain useful for the purposes described above, subject to our providers’ retention terms.

Your rights and choices

Subject to applicable law, you may request access to, correction of or deletion of the personal information we hold about you, and you may object to, or request that we cease, processing for business-development purposes, by contacting info@mcm-labs.com. We will not discriminate against you for exercising any of these rights.

You may withdraw your consent and remove a correspondence reference code and any interest category from this browser at any time by selecting the button below or “Reject” under “Privacy choices,” by clearing your browser’s site data, or by enabling the Global Privacy Control in your browser.

Stop linking my visits

Nevada residents: we do not sell covered information as defined in NRS Chapter 603A. You may nonetheless submit a request directing us not to do so to info@mcm-labs.com.

Security

We use reasonable safeguards, including encrypted (HTTPS) connections to this site. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Children

This site is intended for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16.

Changes to this policy

If we change this policy, we will post the new version here and update the effective date at the top of the page.